Dotclear <= 2.6.2 (categories.php) SQL Injection

2014.05.22
Credit: Egidio Romano
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 6/10
Impact Subscore: 6.4/10
Exploitability Subscore: 6.8/10
Exploit range: Remote
Attack complexity: Medium
Authentication: Single time
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

-------------------------------------------------------------- Dotclear <= 2.6.2 (categories.php) SQL Injection Vulnerability -------------------------------------------------------------- [-] Software Link: http://dotclear.org/ [-] Affected Versions: Version 2.6.2 and probably prior versions. [-] Vulnerability Description: The vulnerable code is located in /admin/categories.php: 70. # Update order 71. if (!empty($_POST['save_order']) && !empty($_POST['categories_order'])) { 72. $categories = json_decode($_POST['categories_order']); 73. 74. foreach ($categories as $category) { 75. if (!empty($category->item_id)) { 76. $core->blog->updCategoryPosition($category->item_id, $category->left, $category->right); 77. } 78. } 79. 80. dcPage::addSuccessNotice(__('Categories have been successfully reordered.')); 81. http::redirect('categories.php'); 82. } User input passed through the $_POST['categories_order'] parameter is not properly sanitized before being used in a call to the dcBlog::updCategoryPosition() method at line 76. This could be exploited to conduct SQL injection attacks leveraging the UPDATE statement defined in the nestedTree::updatePosition() method. Successful exploitation of this vulnerability requires an account with the manage categories permission. [-] Solution: Update to version 2.6.3. [-] Disclosure Timeline: [14/05/2014] - Vendor notified [15/05/2014] - Vendor response [16/05/2014] - Version 2.6.3 released: http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3 [16/05/2014] - CVE number requested [19/05/2014] - CVE number assigned [21/05/2014] - Public disclosure [-] CVE Reference: The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-3783 to this vulnerability. [-] Credits: Vulnerability discovered by Egidio Romano. [-] Original Advisory: http://karmainsecurity.com/KIS-2014-07


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top